From bb5258cb954ed8dde83d168035965040a8f1a00d Mon Sep 17 00:00:00 2001 From: Kevin Wolf Date: Tue, 25 Mar 2014 11:46:04 +0100 Subject: [PATCH 46/48] parallels: Sanity check for s->tracks (CVE-2014-0142) RH-Author: Kevin Wolf Message-id: <1395744364-16049-46-git-send-email-kwolf@redhat.com> Patchwork-id: n/a O-Subject: [EMBARGOED RHEL-6.6/6.5.z qemu-kvm PATCH v2 45/45] arallels: Sanity check for s->tracks (CVE-2014-0142) Bugzilla: 1079314 RH-Acked-by: Max Reitz RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Laszlo Ersek Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1079314 Upstream status: Embargoed This avoids a possible division by zero. Convert s->tracks to unsigned as well because it feels better than surviving just because the results of calculations with s->tracks are converted to unsigned anyway. Signed-off-by: Kevin Wolf --- block/parallels.c | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-) diff --git a/block/parallels.c b/block/parallels.c index 046756b..3db2de9 100644 --- a/block/parallels.c +++ b/block/parallels.c @@ -51,7 +51,7 @@ typedef struct BDRVParallelsState { uint32_t *catalog_bitmap; unsigned int catalog_size; - int tracks; + unsigned int tracks; } BDRVParallelsState; static int parallels_probe(const uint8_t *buf, int buf_size, const char *filename) @@ -87,6 +87,11 @@ static int parallels_open(BlockDriverState *bs, int flags) bs->total_sectors = le32_to_cpu(ph.nb_sectors); s->tracks = le32_to_cpu(ph.tracks); + if (s->tracks == 0) { + qerror_report(QERR_GENERIC_ERROR, + "Invalid image: Zero sectors per track"); + goto fail; + } s->catalog_size = le32_to_cpu(ph.catalog_entries); if (s->catalog_size > INT_MAX / 4) { -- 1.7.1